Re: Can we stop defaulting to 'ident'? - Mailing list pgsql-pkg-yum

From Craig Ringer
Subject Re: Can we stop defaulting to 'ident'?
Date
Msg-id CAMsr+YHAipW2tH-334ZLcROqx4Q55mB7JZY8CyV0AZMi_yfB2g@mail.gmail.com
Whole thread Raw
In response to Re: Can we stop defaulting to 'ident'?  (Stephen Frost <sfrost@snowman.net>)
List pgsql-pkg-yum
On Fri, 20 Dec 2019 at 01:32, Stephen Frost <sfrost@snowman.net> wrote:
Greetings,

* James Cassell (fedoraproject@cyberpear.com) wrote:
> Peer does not work with TCP connections, and I haven't figured how to get,e.g., third-party Java applications working without TCP.

The entire point of peer was to segregate the very insecure 'ident' from
the actually quite secure 'peer' auth, so, no, it's not going to work
over TCP connections- that's more-or-less the point.

Regarding a JDBC connection, you can pass in a "socketFactory", as I
understand it (though I'm no JDBC expert, I'd suggest you address issues
you have with that to the JDBC list):

https://jdbc.postgresql.org/documentation/head/connect.html

Right. PgJDBC doesn't actually have to support it directly, since you can pass your own socketFactory, such as one provided by https://github.com/kohlschutter/junixsocket or https://github.com/jnr/jnr-unixsocket .

As the Java Language specification does not provide for UNIX socket support and no widely used JVM bundles AF_UNIX socket support there's no way for PgJDBC to directly support unix sockets. We could add support for it in jdbc:postgresql:// URLs, but we'd have to do a runtime search of the classpath to find a suitable SocketFactory using a list of known unix socket library implementations ... so why bother? If the user has to install a 3rd party library to do it anyway, they can specify a JDBC URL argument too.

So PgJDBC already has everything it needs there IMO, except perhaps a hint in the documentation. Patches welcome :)

--
 Craig Ringer                   http://www.2ndQuadrant.com/
 2ndQuadrant - PostgreSQL Solutions for the Enterprise

pgsql-pkg-yum by date:

Previous
From: Craig Ringer
Date:
Subject: Re: Can we stop defaulting to 'ident'?
Next
From: Devrim Gündüz
Date:
Subject: Re: Can we stop defaulting to 'ident'?